1

Brand new MacBook Pro - unboxed just a few minutes ago. It's running Sequoia. DNS to external works just fine, and my other devices, including an iPhone and an iPad, work just fine with internal DNS.

I run Pihole internally for both the ad-blocking benefits as well as provide an authoritative DNS server for the various applications I run on my internal network.

I'm able to perform a dig for internal resources and get the expected results, as seen here:

me@MacBook-Pro ~ % dig storage.home.lan

; <<>> DiG 9.10.6 <<>> storage.home.lan
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55954
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;storage.home.lan.      IN  A

;; ANSWER SECTION:
storage.home.lan.   0   IN  A   172.16.10.5

;; Query time: 4 msec
;; SERVER: 172.16.10.2#53(172.16.10.2)
;; WHEN: Thu Dec 12 19:58:25 MST 2024
;; MSG SIZE  rcvd: 61

But trying to SSH, use a web browser, or ping to these internal resources fails. I've found DNS not resolving on Mac OS X and DNS not resolving on Mac OS X but attempting to bounce Discovery and mDNS both fail:

me@MacBook-Pro ~ % sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
Password:
Unload failed: 5: Input/output error
Try running `launchctl bootout` as root for richer errors.
me@MacBook-Pro ~ % sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist
Load failed: 5: Input/output error
Try running `launchctl bootstrap` as root for richer errors.
me@MacBook-Pro ~ % sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.discoveryd.plist
Unload failed: 5: Input/output error
Try running `launchctl bootout` as root for richer errors.
me@MacBook-Pro ~ % sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.discoveryd.plist
Load failed: 5: Input/output error
Try running `launchctl bootstrap` as root for richer errors.

I've rebooted for funsies but that didn't change anything either.

Edit: Just to be abundantly clear - this also affects web browsers. It is not just a terminal problem.

I've narrowed the problem down to macOS is preferring the public DNS server 1.1.1.1 for all DNS queries except for oddly dig. Once I set the DNS to just the internal DNS server, things work fine. I wouldn't consider this a fix per se as I should be able to use an external DNS server should the internal one fail, but this addressed it.

Improve this question
New contributor
h4ckNinja is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
6
  • 2
    This question is similar to: No route to host on iterm2 only. If you believe it’s different, please edit the question, make it clear how it’s different and/or how the answers on that question are not helpful for your problem.
    – Linc Davis
    Commented Dec 13 at 3:42
  • How did you define the DNS servers in Settings? Can you add a screenshot?
    – nohillside ♦
    Commented Dec 13 at 6:40
  • 1
    You should update to the latest version of Sequoia, 15.2. The What's New kbase indicates a fix for DNS resolution when the built-in firewall is enabled; community discussion suggests other fixes were also included, just not mentioned in the release notes.
    – da4
    Commented Dec 13 at 15:29
  • A good question title helps to get attention and answers.
    – nohillside ♦
    Commented Dec 14 at 20:51
  • I’m with @LincDavis if ICMP echo and TCP traffic on port 22/80/443 is blocked on the local network and work outside your router, you don’t have a DNS problem even though the truism is “it’s always DNS”. How are you managing and enabling local network access which is blocked out of the box on macOS Sequoia?
    – bmike ♦
    Commented Dec 14 at 21:38

2 Answers 2

Reset to default
1

One potential solution is to use scoped DNS resolver overrides. I do this for locally-defined hosts as well as for a few VPN connections that I frequently use. This allows you to specify a public anycast DNS resolver e.g. 1.1.1.1 or 8.8.8.8 for general queries, while still allowing certain domains to be explicity resolved via an alternate server(s). This avoids the ambiguity of not knowing which resolver will respond to a query, or whether that response will be correct.

To try this, set your primary OS resolver in System Settings (e.g. 1.1.1.1). Then, for each domain you wish to override, create a file at /etc/resolver/<domain>

For example, here are the Terminal commands to effect this, routing DNS queries for *.foo.lan to 192.168.4.1:

sudo mkdir -p /etc/resolver            
echo "nameserver 192.168.4.1" | sudo tee -a /etc/resolver/foo.lan

You can specify more than 1 nameserver for the domain file if needed, by simply adding additional nameserver 1.2.3.4 lines.

Improve this answer
0

I've narrowed the problem down to macOS is preferring the public DNS server 1.1.1.1 for all DNS queries except for oddly dig. Once I set the DNS to just the internal DNS server, things work fine. I wouldn't consider this a fix per se as I should be able to use an external DNS server should the internal one fail, but this addressed it.

The "fix" is to remove the public DNS server, despite it being second in the list from DHCP, and hard code just the internal DNS. Weird, confusing, as other devices work without needing that change, but marking this as "answered".

Improve this answer
New contributor
h4ckNinja is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 1
    How did you configure this DNS fallback? Adding several DNS servers in network settings doesn't do this, any of them can be used by the OS.
    – nohillside ♦
    Commented Dec 13 at 9:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .